Fix sync-releases workflow and guard its manual trigger

[jolelievre]

Problem

The nightly sync-releases workflow has been failing for a few days (example run):

requests.exceptions.HTTPError: {"message":"pagination offset too large for anonymous requests; sign in to page further","errinfo":{}}

Docker Hub changed its API policy: anonymous requests can no longer paginate past ~1000 results. The backlog step lists all library/php tags (~15,600 today) through hub.docker.com/v2/repositories with page_size=100, so it dies around page 10.

Fix

DockerApi.get_tags() now uses the Docker registry API instead of the Docker Hub one:

1. fetch an anonymous pull token from auth.docker.io
2. call registry-1.docker.io/v2/<image>/tags/list, which returns the full tag list in a single response — no pagination limit, no account needed

The return shape is unchanged (a list of {'name': <tag>} dicts), so backlog.py and tag_manager.py work as before. The short-lived token is never served from the requests cache, and Link header pagination is handled defensively in case the registry starts paginating one day.

Verified against the live API: 15,590 tags returned, all X.Y-apache versions found (5.3 → 8.5), with and without cache, on the pinned requests-cache 0.7.5. All 30 unit tests pass, flake8 clean.

Guarded manual trigger

Manual workflow_dispatch runs (the trigger already existed) are now restricted to active members of the prestashop-sa team, through the shared team-guard action from PrestaShop/.github. Scheduled runs are unaffected by the guard. The check uses the existing JARVIS_TOKEN secret (already has read:org, same as in PrestaShop core workflows).

⚠️ Merge order: the team-guard action must land on PrestaShop/.github master first (PR to follow) — until then a manual dispatch would fail at the guard step. The scheduled run is not affected either way.

Also bumps actions/checkout and actions/setup-python v2 → v5 to clear the Node 20 deprecation warnings visible in the failing runs.